import assert from "node:assert/strict";
import crypto from "node:crypto";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { createRequire } from "node:module";
import { fileURLToPath } from "node:url";
import ts from "../../web/node_modules/typescript/lib/typescript.js";

const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
const reportPath = path.join(root, "tests/golden/M13-03C/host-call-report.json");
const manifestPath = path.join(root, "tests/golden/M13-03C/manifest.json");
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "m13-03c-host-call-"));
const hashFile = (file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
  const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
  const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText
    .replace('require("./asset-path")', 'require("./asset-path.cjs")').replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
  fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
}
const protocol = createRequire(import.meta.url)(path.join(temporary, "scripting-platform.cjs"));
try {
  const digest = "a".repeat(64); const permissions = new Set(protocol.SCRIPT_PERMISSIONS);
  const call = (name, parameters) => ({ schemaVersion: 1, requestId: `host:${name.toLowerCase()}`, scriptId: "clean", call: name, permission: name, parameters });
  const accepted = [
    protocol.parseScriptHostCall(call("READ_MAIN", { revision: 3 }), permissions),
    protocol.parseScriptHostCall(call("READ_ASSET", { path: "//assets/model.bin", expectedSha256: digest }), permissions),
    protocol.parseScriptHostCall(call("WRITE_MAIN", { revision: 3, operation: "object.transform", payload: { objectId: "obj:1", x: 1 } }), permissions),
    protocol.parseScriptHostCall(call("WRITE_ASSET", { path: "assets/out.bin", byteLength: 4, sha256: digest }), permissions),
    protocol.parseScriptHostCall(call("SUBMIT_SERVER_JOB", { inputBlendSha256: digest, settingsSha256: digest }), permissions),
  ];
  const blocked = {};
  for (const [name, input] of [["unknown", call("EXECUTE", {})], ["permission", { ...call("READ_MAIN", { revision: 3 }), permission: "WRITE_MAIN" }], ["fields", call("READ_MAIN", { revision: 3, extra: true })], ["path", call("READ_ASSET", { path: "../escape", expectedSha256: digest })]]) {
    try { protocol.parseScriptHostCall(input, permissions); blocked[name] = "ACCEPTED"; } catch (error) { blocked[name] = error instanceof Error ? error.message.split(":", 1)[0] : String(error); }
  }
  assert.deepEqual(accepted.map((item) => item.call), ["READ_MAIN", "READ_ASSET", "WRITE_MAIN", "WRITE_ASSET", "SUBMIT_SERVER_JOB"]);
  assert.ok(accepted.every((item) => item.execution === "DISABLED"));
  assert.deepEqual(blocked, { unknown: "SCRIPT_POLICY_DENIED", permission: "SCRIPT_POLICY_DENIED", fields: "SCRIPT_MANIFEST_INVALID", path: "SCRIPT_MANIFEST_INVALID" });
  const report = { schemaVersion: 1, task: "M13-03C", operation: "SCRIPT_HOST_CALL_ALLOWLIST", acceptedCalls: accepted.map((item) => item.call), blocked, structuredParameters: true, execution: "DISABLED", invariants: { allowlistOnly: true, permissionBound: true, unknownFieldsRejected: true, projectPathsNormalized: true }, nextTask: "M13-03D" };
  if (process.env.UPDATE_M13_03C_REPORT === "1") { fs.mkdirSync(path.dirname(reportPath), { recursive: true }); fs.writeFileSync(reportPath, JSON.stringify(report, null, 2) + "\n"); }
  assert.deepEqual(JSON.parse(fs.readFileSync(reportPath, "utf8")), report);
  const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
  assert.deepEqual({ schemaVersion: manifest.schemaVersion, task: manifest.task, parentTask: manifest.parentTask, nextTask: manifest.nextTask }, { schemaVersion: 1, task: "M13-03C", parentTask: "M13-03B", nextTask: "M13-03D" });
  for (const artifact of Object.values(manifest.artifacts)) assert.equal(hashFile(path.join(root, artifact.path)), artifact.sha256, `artifact hash mismatch ${artifact.path}`);
  process.stdout.write(`script-host-call-ok accepted=${accepted.length} blocked=${Object.keys(blocked).length} structured=true execution=DISABLED next=${manifest.nextTask}\n`);
} finally { fs.rmSync(temporary, { recursive: true, force: true }); }